WTW

Global risk management, insurance brokerage, consulting

PAM Engineering Lead

Security Engineering & ArchitectureConfirmed live in the last 24 hours

Full-timeIn-person

About the Job

Requirements

At least 5 years of IAM/PAM SaaS engineering, including at least 3 years of hands-on experience with CyberArk (Idira) Privileged Access Manager (Vault, CPM, PSM, and PVWA), and demonstrated experience leading PAM engineering teams.
Strong understanding of privileged access management concepts, including privileged account lifecycle, credential and SSH key rotation, session isolation and monitoring, least-privilege access, and just-in-time access.
Experience integrating CyberArk with Active Directory/Entra ID, Windows, Unix/Linux, databases, network devices, and SaaS applications.
Proficiency in scripting with the CyberArk REST API, PACLI, PowerShell, and Python for automation and integration.
Working knowledge of identity and secrets management standards, including SAML, OAuth2/OIDC, and secrets management such as Conjur/AAM or equivalent.
Experience with access governance frameworks and compliance mapping, such as ISO 27001, SOC 2, GDPR, or similar.
Demonstrated experience writing user stories, managing a backlog, or working closely with product/agile teams.
Ability to translate technical details for engineers and business stakeholders.
Project management skills.
Analytical and problem-solving capabilities.

Responsibilities

Lead the design, build, and maintenance of CyberArk (Idira) Privileged Access Manager solutions, including Vault architecture, Safes, target platforms, and session management across WTW.
Own and prioritize the PAM platform backlog, set technical direction, and act as product owner for the privileged access roadmap based on business risk, compliance deadlines, and stakeholder demand.
Oversee the build and maintenance of privileged account onboarding and credential/SSH key rotation automation via the Central Policy Manager (CPM), integrating with Active Directory/Entra ID, Windows, Unix/Linux, databases, and network devices.
Define and govern privileged access policies, least-privilege and just-in-time access models, and privileged session review campaigns across WTW.
Act as the senior technical authority within IAM, covering all aspects of Privileged Access Management.
Drive solution development through problem-solving, ensure adherence to security controls, policies, and standards, and focus on automation and control.
Influence senior stakeholders across IT, Compliance, and the business to align the privileged access roadmap with WTW's risk and regulatory priorities.
Develop skills and capabilities within the IAM team by mentoring engineers and driving process improvements and documentation.
Oversee configuration and troubleshooting of CyberArk connectors and platforms (PSM, CPM, PVWA) to Windows, Unix/Linux, database, and network-device targets, working hands-on where required.
Author and review custom platforms, connection components, and automation scripts using the CyberArk REST API, PACLI, PowerShell, and Python, and set standards for the wider team.
Govern operational execution of privileged session recording and review, Safe membership reviews, and privileged account discovery initiatives.
Oversee platform health, ensure credential rotation and session recording failures are resolved, and maintain audit-trail integrity.
Lead sprint planning, backlog grooming, and roadmap reviews.
Own roadmap and status communications for leadership and stakeholders.
Oversee the privileged account lifecycle, including onboarding, offboarding, and account updates.
Ensure compliance with internal policies and external regulations, escalating risks as needed.
Own the response to audit findings and drive remediation measures to closure.
Oversee resolution of escalated issues and support tickets, providing senior technical input where needed.

Desired Qualifications

CyberArk Defender/Sentry-PAM certification.
Experience with BeyondTrust, Delinea (Thycotic), or HashiCorp Vault as a comparison point.
Familiarity with Agile/Scrum ceremonies and tools such as Jira and Azure DevOps.
Exposure to Zero Trust principles and NIST SP 800-53 AC/IA control families.

The Role

Willis Towers Watson IT is currently seeking a senior, experienced candidate for the position of PAM Engineering Lead. In this position, the successful candidate must demonstrate significant hands-on experience engineering CyberArk PAM solutions, together with the seniority to set technical direction, own and prioritise a product backlog, and mentor engineers within the team. The main focus of this position is to lead the build, operation and continuous improvement of our CyberArk (Idira) platform while acting as product owner for the privileged access platform roadmap, influencing senior stakeholders and ensuring successful delivery of service, stakeholder alignment and continuous development of the IAM Team.

Major Accountabilities:

Lead the design, build and maintenance of CyberArk (Idira) Privileged Access Manager solutions, including Vault architecture, Safes, target platforms and session management across WTW.
Own and prioritise the PAM platform backlog, setting technical direction and acting as product owner for the privileged access roadmap based on business risk, compliance deadlines and stakeholder demand.
Oversee the build and maintenance of privileged account onboarding and credential/SSH key rotation automation via the Central Policy Manager (CPM), integrating with Active Directory/Entra ID, Windows, Unix/Linux, databases and network devices.
Define and govern privileged access policies, least-privilege and just-in-time access models and privileged session review campaigns across WTW.
Act as the senior technical authority within IAM, covering all aspects of Privileged Access Management.
Drive solution development through problem solving, ensuring adherence to Security Controls, Policies and Standards with a focus on automation and control.
Influence senior stakeholders across IT, Compliance and the business to align the privileged access roadmap with WTW's risk and regulatory priorities.
Lead the development of skills and capabilities within the IAM team, mentoring engineers and driving process improvements and documentation.

Responsibilities

Oversee configuration and troubleshooting of CyberArk connectors and platforms (PSM, CPM, PVWA) to Windows, Unix/Linux, database and network device targets, working hands-on where required.
Author and review custom platforms, connection components and automation scripts (CyberArk REST API, PACLI, PowerShell and Python), setting standards for the wider team.
Govern the operational execution of privileged session recording and review, Safe membership reviews, and privileged account discovery initiatives.
Oversee platform health, ensuring credential rotation and session recording failures are resolved and audit trail integrity is maintained.
Lead sprint planning, backlog grooming and roadmap reviews.
Own roadmap and status communications for leadership and stakeholders.
Oversee the privileged account lifecycle, including onboarding, offboarding and account updates.
Ensure compliance with internal policies and external regulations, escalating risks as needed.
Own the response to audit findings and drive remediation measures to closure.
Oversee resolution of escalated issues and support tickets, providing senior technical input where needed.

The Requirements

5+ years in IAM/PAM SaaS engineering, including 3+ years hands-on with CyberArk (Idira) Privileged Access Manager (Vault, CPM, PSM, PVWA), with demonstrated experience leading PAM engineering teams.
Strong understanding of PAM concepts: privileged account lifecycle, credential/SSH key rotation, session isolation and monitoring, least-privilege and just-in-time access.
Experience integrating CyberArk with Active Directory/Entra ID, Windows, Unix/Linux, databases, network devices and SaaS applications.
Scripting proficiency with the CyberArk REST API, PACLI, PowerShell and Python for automation and integration.
Working knowledge of identity and secrets management standards: SAML, OAuth2/OIDC and secrets management (Conjur/AAM or equivalent).
Experience with access governance frameworks and compliance mapping (ISO 27001, SOC 2, GDPR or similar).
Demonstrated experience writing user stories, managing a backlog, or working closely with product/agile teams.
Strong stakeholder communication skills, able to translate technical detail for both engineers and business stakeholders.
Good project management skills.
Positive team-first attitude with strong verbal and written communication skills.
Must possess sound analytical and problem-solving capabilities.

Nice to have

CyberArk certification (CyberArk Defender/Sentry - PAM).
Experience with BeyondTrust, Delinea (Thycotic) or HashiCorp Vault as a comparison point.
Familiarity with Agile/Scrum ceremonies and tools (Jira, Azure DevOps).
Exposure to Zero Trust principles and NIST SP 800-53 AC/IA control families.

Note: Employment-based non-immigrant visa sponsorship and/or assistance is not offered for this specific job opportunity.

Compensation and Benefits

Base salary range and benefits information for this position are being included in accordance with requirements of various state/local pay transparency legislation. Please note that salaries may vary for different individuals in the same role based on several factors, including but not limited to location of the role, individual competencies, education/professional certifications, qualifications/experience, performance in the role and potential for revenue generation (Producer roles only).

Compensation

The base salary compensation range being offered for this role is $130,000.00-$170,000.00 USD annually. This role is also eligible for an annual short-term incentive bonus.

Company Benefits

WTW provides a competitive benefit package which includes the following (eligibility requirements apply):

Health and Welfare Benefits: Mental health/emotional wellbeing (including Employee Assistance Program), medical (including prescription drug coverage and fertility benefits), dental, vision, Health Savings Account, Commuter Accounts, Health Care and Dependent Care Flexible Spending Accounts, company-paid life insurance, supplemental life insurance, AD&D, group accident, group critical illness, group legal, identify theft protection, wellbeing program, adoption assistance, surrogacy assistance, auto/home insurance, pet insurance and other work/life resources
Leave Benefits: Paid holidays, annual paid time off (includes state/local paid leave where required), company-paid disability (short-term and long-term disability), other leaves (e.g., bereavement, FMLA, ADA, jury duty, military leave, and Parental and Adoption Leave), Paid Time Off (only included for Washington roles)
Retirement Benefits: Qualified contributory pension plan (if eligible) and 401(k) plan with annual nonelective company contribution. Non-qualified retirement plans available to senior level colleagues who satisfy the plans’ eligibility requirements.

Pursuant to the San Francisco Fair Chance Ordinance and Los Angeles County Fair Chance Ordinance for Employers, we will consider for employment qualified applicants with arrest and conviction records.

This position will remain posted for a minimum of three business days from the date posted or until sufficient/appropriate candidate slate has been identified.

EOE, including disability/vets

About the Company

WTW

Global risk management, insurance brokerage, consulting

Willis Towers Watson provides risk management, advisory, and brokerage services to organizations worldwide. Its two segments are Risk & Broking, which identifies, quantifies, and places insurance coverage, and Health, Wealth & Career, which offers consulting, technology, and administration for health benefits, retirement plans, and talent programs. The company blends advisory services, technology platforms, and brokerage capabilities to deliver integrated risk and people solutions rather than relying on a single service line. Its goal is to help clients turn risk into a path for growth by aligning risk management with health, retirement, and talent strategies to support organizational success.

Company size: 10,001+
Company stage: IPO
Headquarters: London, United Kingdom
Founded: 1828

Recently Posted Jobs

Explore more opportunities at WTW

See more jobs